Blind Hypervisor Memory Isolation via Security Controller
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data processing systems face challenges in securely isolating and protecting data within guest execution environments from access by other processes, particularly in multi-tenant cloud platforms where data confidentiality is critical.
Innovation Solution
The introduction of a 'blind hypervisor' architecture that manages virtual machines without visibility into their data, combined with a page ownership table system allowing each process to control access to physical memory pages, ensuring that higher privilege processes cannot access data owned by lower privilege processes, and implementing encryption to secure data access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a traditional hypervisor manages virtual machines with full visibility into their data, then resource management and scheduling efficiency are improved, but data security and isolation between guest execution environments deteriorate
Solution Approach 1:
The patent introduces a security controller as an intermediary component between the hypervisor and guest execution environments. This security controller acts as a mediator that enforces memory access permissions and validates data access requests, allowing the hypervisor to manage resources efficiently while preventing unauthorized data access. The security controller intercepts and validates memory access requests, ensuring that even the hypervisor cannot access data without proper permission validation.
2Ease of operation
If higher privilege processes can access all memory pages for system management, then system control capability is improved, but unauthorized access to lower privilege process data worsens
Solution Approach 1:
The patent inverts the traditional access control model by requiring that even privileged processes must obtain explicit permission to access memory pages. Instead of assuming privileged processes have automatic access rights, the system requires permission validation through the security controller for all memory access requests. This inversion ensures that system control capability is maintained through legitimate permission grants while preventing unauthorized access by default.
Solution Approach 2:
The security controller serves as an intermediary that validates memory access permissions for all processes regardless of their privilege level. It intercepts memory access requests and validates them against stored permission information, ensuring that system control operations are permitted while blocking unauthorized data access attempts from any process.
3Productivity
If memory is allocated dynamically to guest execution environments, then resource utilization efficiency is improved, but the risk of data leakage between environments worsens
Solution Approach 1:
The security controller acts as an intermediary that validates all memory access requests to dynamically allocated regions. It maintains permission information for each memory page and validates access requests against this information, ensuring that dynamic memory allocation provides resource utilization efficiency while preventing data leakage between guest execution environments through enforced access control.
Solution Approach 2:
The patent implements fine-grained access control at the memory page level, where each page can have independent permission settings. This local quality approach allows different security policies to be applied to different memory regions, enabling secure dynamic allocation while maintaining strict isolation where needed and allowing controlled sharing where appropriate.
Data Source
Figure 1
Figure 2
Figure 2
AI summary
A data processing system for processing data using a memory having a plurality of memory regions, a given memory region within said plurality of memory regions having an associated owning process having exclusive rights to control access to said given memory region, said system comprising: a security controller to: receive a request to initialise a guest execution environment; claim one or more regions of memory to be owned by said security controller; store executable program code of said guest execution environment within said one or more regions of memory; and transfer ownership of said one or more regions to said guest execution environment.